CVE-2019-11039 Out-of-bounds read in iconv.c
An integer overflow in PHP's MIME header parsing allows attackers to trigger out-of-bounds reads, leading to information disclosure or application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11039?
CVE-2019-11039 is a medium-severity vulnerability in Debian Debian Linux, published on 18 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
Which versions are affected by CVE-2019-11039?
It affects 4 products.
Products include Debian Debian Linux, Opensuse Leap, Php Php, Redhat Software Collections.
How do I fix CVE-2019-11039?
Upgrade to a fixed version.
Is CVE-2019-11039 being exploited?
There is no known exploitation of CVE-2019-11039 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-fc8g-9mgh-947m, UBUNTU-CVE-2019-11039.